If your VMs need general outbound internet (patching, repo downloads, external APIs), and you don’t want public IPs → Cloud…